For the websites I run, I block the IPs at the router. Not just the usual suspect IP blocks, but TOR nodes, since anonymous IPs are nice, but the exit nodes are used oftentimes for various forms of attack. Blocking at the router means that the bad guys don't even get to the web server to mess with it.
I might go fancier and redirect all blocked IPs to a bogus webserver which "tarpits" requests (basically pretends to serve pages up, but really slowly before dropping the connection... similar to a number of voice mail systems which put you on hold for an hour, only to hang up on you), but the blocking via the network is good for now.
I've encountered a number of methods to help with unknown accounts that are not too intrusive:
1: Are there any other members who know/will sponsor the person.
2: Is the new member willing to pony up a few bucks? One gaming site I am on asks for $5 via PayPal/BitCoin for a new account, not that they need the cash, but it stops spammers and Internet trolls cold.
3: The member gets allowed to post one item in the first 24 hours, and is limited until they post about 10-12 times, and they haven't been flagged/reported as a troll or spammer.
4: Any accounts made using "free" email places get tossed unless someone asks for an exception beforehand.
These methods may or may not help out, but the biggest thing I've found that helps is blocking Chinese and African IPs at the router. Yes, they might hack from a botnet in the US, but at least the attacks are lessened.
